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IM THE CLAIMS : 

Please consider the claims as follows: 

1 . (previously presented) A method for monitoring usage of resources 
allocated to a plurality of nodes of a network, comprising the steps of: 

assigning a parameter to each of a plurality of nodes of the network, wherein 
each parameter is indicative of a rate of change of usage of said resources of the node; 

locally monitoring, at each of the nodes, the rate of change of the usage of said 

resources of the node; 

reporting to a centralized management station of the network when the rate of 
change of the usage of the resources of one of the nodes exceeds a first threshold; 

initiating a poll of resources of nodes of the network by the centralized 
management station in response to reporting from the node or a time interval being 
exceeded; 

determining whether a sum of the currently reported rates of change of usage of 
node resources, received in response to the poll initiated by the management station, 
exceeds a second threshold; and 

generating an alarm if the sum of the currently reported rates of change of usage 
of node resources exceeds the second threshold, else updating the time interval. 

2-5. (cancelled) 

6. (previously presented) The method of claim 1 . further including the step of 
adjusting the usage of the resources at one or more of said nodes. 

7. (previously presented) A method for monitoring usage of a resource in 
nodes of a network, comprising the steps of: 

(a) monitoring usage of the resource in a node to determine when a rate of 
change of the usage exceeds a first predetemnined threshold; 

(b) reporting to a management station of the network when the rate of change of 
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the usage exceeds said first predetermined threshold; and 

(c) initiating a poll of resources in the nodes of the network by the nnanagement 
station in response to reporting from the node or a time interval being exceeded. 

8. (previously presented) A method for monitoring usage of resources in 
nodes of a network, comprising the steps of: 

asynchronous reporting of an event to a management station of the network 
when a rate of change of a usage of at least one resource of said resources in any of 
said nodes deviates from a prescribed norm; and 

periodic polling of said nodes in accordance with a polling inteival. and aperiodic 
polling of said nodes in response to reporting of said event, wherein a tunable 
parameter is adjusted in response to the usage. 

9. (previously presented) A method for managing a global resource of a 
network in oreler to reduce the amount of monitoring related traffic, comprising the steps 
of: 

assigning a local threshold to each of a plurality of node resources of a 
respective plurality of nodes of the network; 

reporting to a management station of the network when a value indicative of 
node resource usage exceeds the assigned local threshold as determined using local 
monitoring of the node resource; 

initiating a poll, by the management station, of node resource usage by the 
nodes of the network in response to a determination that a sum of previously reported 
values indicative of node resource usage received from reporting nodes plus an upper 
bound of node resource usage for non-reporting nodes exceeds a threshold; and 

generating an alarm if the sum of the currently reported values indicative of node 
resource usage, received in response to the poll initiated by the management station, 
exceeds the threshold. 

1 0. (previously presented) a method for managing a global resource of a 
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network in order to reduce the amount of monitoring related traffic, comprising the steps 
of: 

assigning a local threshold to each of a plurality of node resources of a 
respective plurality of nodes of the network; 

reporting to a management station of the network when a rate of change of 
usage of said node resource exceeds the local threshold as determined using local 
monitoring of the node resource, wherein said rate of change of usage of said node 
resource is determined using a variable time interval comprising a difference between a 
current time and a time at which the node was last polled by the management station; 

initiating a poll, by the management station, of the node resource usage of the 
nodes of the network in response to receiving reporting from one of the nodes or a time 

interval being exceeded; 

detemiining whether a sum of the currently reported rates of change of usage of 
node resources, received in response to the poll initiated by the management station, 

exceeds a threshold; and 

generating an alarm if the sum of the currently reported rates of change of usage 

of node resources exceeds the threshold. 

1 1 . (previously presented) The method defined in claim 8 wherein said nodes 
are selected from the group consisting of routers. switches, bridges, and firewall 
devices. 

12. (previously presented) The method defined in claim 8 wherein said nodes 
are selected from the group consisting of servers, hosts, and layer 4-7 switches. 



13. (cancelled) 



14. (previously presented) The method of claim 7. further comprising: 

(d) summing all the reported rate of change of the usage of the resources: and 

(e) generating an alarm if the sum exceeds a second threshold, else updating the 
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time interval. 
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